<div style="font-family:Calibri, Arial, Helvetica, sans-serif; font-size:12.0pt; color:#1F497D"><div>Not built into ovirt AFAIK, but an ebtables rule can allow you to filter out mac+ip combinations </div><div><br></div><div>Look at the anti-spoofing rules on ebtables.netfilter.org</div><div><br></div><div>It doesn't prevent the user adding it in the vm, but the infrastructure blocks it's usage.</div>
<div><br></div>
</div><div class="quoted_separate_body"/><div id="quoted_header" style="clear:both;"><hr style="border:none; height:1px; color:#E1E1E1; background-color:#E1E1E1;"/><div style="border:none; padding:3.0pt 0cm 0cm 0cm"><span style="font-size:11.0pt;font-family:Calibri, Arial, Helvetica, sans-serif"><b>From:</b> Bill Bill <jax2568@outlook.com><br><b>Sent:</b> Aug 3, 2016 22:40<br><b>To:</b> users@ovirt.org<br><b>Subject:</b> [ovirt-users] IP Address Stealing<br></span></div></div><br type='attribution'><div id="quoted_body">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
<div class="WordSection1">
<p class="MsoNormal">Hello,</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It is possible to prevent a VM from adding an IP? For example, if we provision a VM with one IP, if the user has root access they can simply add random IP’s from within the same range as sub interfaces: eth0:0 eth0:1 eth0:2 so on and so
forth.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Subnetting is not ideal in this situation because it’s a huge waste of IP space.</p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif"><o:p> </o:p></span></p>
</div>
</div>